5 ms·
I don't really see why the problem is with the EUs requirement and not the browsers brain dead implementation of trust. Put these certificates into the store a
by yakak 4y ago
I don't really see why the problem is with the EUs requirement and not the browsers brain dead implementation of trust.
Put these certificates into the store and mark the connection EIDAS-DE, etc instead of that stupid little lock that tells us nothing about which of thousands of CA scams with opaque shell company structures it is.
- lesserknowndan 4y agoThe real problem with this is that such a CA can issue a certificate for a domain like google.com that it has no right to issue and the browser will assume that it can safely connect to a server using that certificate. This would allow EU governments - such as Turkey - to easily man-in-the-middle people’s web connections to such services. Now while Chrome can try and determine whether or not the certificate is valid for google.com, it would be harder to do for lesser known sites. I can foresee yet another DNS record that informs what CAs should be expected to secure domains within a DNS zone.
- lesserknowndan 4y agoHaha. It seems there is a DNS record for exactly this. See linked article for good discussion: https://www.devever.net/~hl/acme-caa-live https://www.devever.net/~hl/acme-caa-live
- ThePowerOfFuet 4y ago> This would allow EU governments - such as Turkey - to easily man-in-the-middle people’s web connections to such services. Turkey is not an EU member state, and at this point membership is not looking likely for the next 15 or 20 years. Hungary, on the other hand, is — but I am not sure Orbán would try such a stunt given what would follow.
- lesserknowndan 4y agoSorry, forgot for a moment which timeline I’m in.